Active locking mechanism using machine learning

ABSTRACT

Methods and systems disclosed herein describe using machine learning to lock and unlock a device. Machine learning may be trained to recognize one or more features. Once the device has been trained to recognize one or more features, a user may define an unlock condition for the device using the one or more trained features. After defining the unlock condition, the device may be locked by verifying the one or more features that the user defined as the unlock condition using machine learning. When verification is successful, the device may be unlocked and the user allowed to access the device.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.17/010,917, filed on Sep. 3, 2020 and entitled “Active Locking MechanismUsing Machine Learning,” which is a continuation of U.S. applicationSer. No. 16/671,290 (now U.S. Pat. No. 10,795,984), filed on Nov. 1,2019 and entitled “Active Locking Mechanism Using Machine Learning,” theentireties of which are hereby incorporated by reference.

FIELD OF USE

Aspects of the disclosure relate generally to device security and, morespecifically, to using machine learning to lock and unlock a device.

BACKGROUND

Devices may lock after a certain period of inactivity or in response toa user command

This is especially true if the device contains highly-sensitive orconfidential information. To unlock a device, a user may enter apersonal identification number (PIN) or password. Alternatively, theuser may unlock a device using a biometric identifier, such as afingerprint or facial recognition. However, these traditional means ofunlocking a device have their shortfalls. For instance, the user may becoerced, or otherwise compelled, to disclose their PIN and/or password.Alternatively, biometric identifiers may be publicly available andobtained without the user's permission. These biometric identifiers maythen be used to unlock the user's device. Accordingly, there is a needto maintain a lock on a device even when a user may be coerced, orcompelled, to unlock their device.

Aspects described herein may address these and other problems, andgenerally improve the efficiency and security of a device.

SUMMARY

The following presents a simplified summary of various aspects describedherein. This summary is not an extensive overview, and is not intendedto identify key or critical elements or to delineate the scope of theclaims. The following summary merely presents some concepts in asimplified form as an introductory prelude to the more detaileddescription provided below. Corresponding apparatus, systems, andcomputer-readable media are also within the scope of the disclosure.

Methods and systems disclosed herein may using machine learning to lockand unlock a device. A device may include a machine learning-basedlocking application. The machine learning-based locking application maybe trained to recognize one or more features. These features may includeuser features (e.g., facial recognition, fingerprint recognition, voicerecognition, retina recognition, etc.), as well as environmentalfeatures (e.g., location, background images, ambient sounds, etc.). Oncethe machine learning-based locking application is capable of recognizingthe trained user and environmental features, the user may be able todefine an unlock condition for the device using one or more of thetrained user and/or environmental features (e.g., conditions). In someinstances, the user may also be able to set date and time restrictionsas part of the unlocking condition. After defining the unlock condition,the device may be locked, for example, using the machine learning-basedlocking application.

To unlock the device, the unlock condition may have to be satisfied.Satisfying the unlock condition may include verifying the one or morefeatures that the user defined as the unlock condition. This may includeverifying one or more user features, environmental features (e.g.,conditions), and/or time-based restrictions. When verification issuccessful, the machine learning-based locking application may unlockthe device and allow the user to access the device. By using a machinelearning-based locking application, device security may be improved, forexample, by preventing a user from unlocking the device under duress orin response to being compelled to do so. Moreover, the machinelearning-based locking application may prevent a thief from accessingthe device, for example, if the device were stolen, since a thief wouldbe unable to satisfy the unlock condition. Accordingly, the machinelearning-based locking application improves the efficiency and securityof locking a device.

These features, along with many others, are discussed in greater detailbelow.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure is described by way of example and not limited inthe accompanying figures in which like reference numerals indicatesimilar elements and in which:

FIG. 1 shows an example of a control processing system in which one ormore aspects described herein may be implemented;

FIG. 2 shows an example computing device in accordance with one or moreaspects described herein;

FIG. 3 shows a flow chart of a process for training a machine learningmodel to recognize one or more user features according to one or moreaspects of the disclosure;

FIG. 4 shows an example of configuring a locking mechanism with one ormore authentication features according to one or more aspects of thedisclosure;

FIG. 5 shows an example of training the locking mechanism to recognizeone or more user features according to one or more aspects of thedisclosure;

FIG. 6 shows a flow chart of a process for locking a device according toone or more aspects of the disclosure;

FIG. 7 shows an example of defining an unlock condition according to oneor more aspects of the disclosure;

FIG. 8 shows a flow chart of a process for unlocking the deviceaccording to one or more aspects of the disclosure; and

FIGS. 9A and 9B show an example of failed unlock attempt according toone or more aspects of the disclosure.

DETAILED DESCRIPTION

In the following description of the various embodiments, reference ismade to the accompanying drawings, which form a part hereof, and inwhich is shown by way of illustration various embodiments in whichaspects of the disclosure may be practiced. It is to be understood thatother embodiments may be utilized and structural and functionalmodifications may be made without departing from the scope of thepresent disclosure. Aspects of the disclosure are capable of otherembodiments and of being practiced or being carried out in various ways.In addition, it is to be understood that the phraseology and terminologyused herein are for the purpose of description and should not beregarded as limiting. Rather, the phrases and terms used herein are tobe given their broadest interpretation and meaning.

By way of introduction, aspects discussed herein may relate to methodsand techniques for locking and unlocking a device using machinelearning. A user may train a device to recognize one or more featuresusing machine learning. The user may indicate (e.g., define) an unlockcondition under which one or more of the trained features need to beverified before the device is unlocked. This represents an improvementover traditional password-based and biometric-based unlockingmechanisms, which may be susceptible to being cracked.

Methods and systems disclosed herein may using machine learning to lockand unlock a device. A device may include a machine learning-basedlocking application. The machine learning-based locking application maybe trained to recognize one or more features. These features may includeuser features (e.g., facial recognition, fingerprint recognition, voicerecognition, retina recognition, etc.), as well as environmentalfeatures (e.g., location, background images, ambient sounds, etc.). Oncethe machine learning-based locking application is capable of recognizingthe trained user and environmental features (e.g., conditions), the usermay be able to indicate (e.g., define) an unlock condition for thedevice using one or more of the trained user and/or environmentalfeatures (e.g., conditions). In some instances, the user may also beable to set date and time restrictions as part of the unlockingcondition. After defining the unlock condition, the device may belocked, for example, using the machine learning-based lockingapplication.

To unlock the device, the unlock condition may have to be satisfied.Satisfying the unlock condition may include verifying the one or morefeatures that the user defined as the unlock condition. Whenverification is successful, the machine learning-based lockingapplication may unlock the device and allow the user to access thedevice. By using a machine learning-based locking application, devicesecurity may be improved, for example, by preventing a user fromunlocking the device under duress or in response to being compelled todo so. Moreover, the machine learning-based locking application mayprevent a thief from accessing the device, for example, if the devicewere stolen, since a thief would be unable to satisfy the unlockcondition. Accordingly, the machine learning-based locking applicationimproves the efficiency and security of a device.

Turning to FIG. 1 , a system 100 is shown that includes a first userdevice 110, a second user device 120, and a server 130, connected to afirst database 140, interconnected via network 150.

First user device 110 may be a mobile device, such as a cellular phone,a mobile phone, a smart phone, a tablet, or a laptop. First user device110 may provide a first user with access to various applications andservices. For example, first user device 110 may provide the first userwith access to the Internet. Additionally, first user device 110 mayprovide the first user with one or more applications (“apps”) locatedthereon. The one or more applications may provide the first user with aplurality of tools and access to a variety of services. In someembodiments, the one or more applications may include a lockingapplication that uses machine learning to establish locking andunlocking conditions for first user device 110. The locking applicationmay be obtained from an online retail store or a digital distributionservice, such as iTunes® or Google Play®. Alternatively, the lockingapplication may be installed by an administrator, for example, as partof a mobile device management (MDM) program. In some embodiments, thelocking application may be a default locking mechanism on the device,installed by a manufacturer of the device or the developer of thedevice's operating system.

Second user device 120 may be a computing device configured to allow auser to execute software for a variety of purposes. Second user device120 may belong to the first user that accesses first user device 110,or, alternatively, second user device 120 may belong to a second user,different from the first user. Second user device 120 may be a desktopcomputer, laptop computer, or, alternatively, a virtual computer. Thesoftware of second user device 120 may include one or more web browsersthat provide access to websites on the Internet. In some embodiments,second user device 120 may include a locking application that usesmachine learning to establish locking and unlocking conditions for firstuser device 110.

Server 130 may be any server capable of executing administrative console132. Additionally, server 130 may be communicatively coupled to firstdatabase 140. In this regard, server 130 may be a stand-alone server, acorporate server, or a server located in a server farm or cloud-computerenvironment. According to some examples, server 130 may be a virtualserver hosted on hardware capable of supporting a plurality of virtualservers.

Administrative console 132 may be server-based software configured toprovide an administrator (e.g., system administrator, networkadministrator) with management tools to administer a network. Thesetools may allow the administrator to remotely manage devices, adddevices to the network, change passwords, reset passwords, provision newuser accounts, de-provision user accounts, etc. In some instances, theadministrative console 132 may allow an administrator to remotely lock adevice. Alternatively, the administrative console 132 may allow anadministrator to unlock a device, for example, when a user forgets theirpassword or unlock conditions. In this regard, an administrator mayadhere to certain policies when unlocking a user's device. For example,the administrator may unlock the device in accordance with the two-manrule or, alternatively, the three-man rule.

First database 140 may be configured to store information on behalf ofadministrative console 132. According to some embodiments, firstdatabase 140 may be a database or table configured to provide directoryservices, for example, using Lightweight Directory Access Protocol(LDAP), Active Directory, or an equivalent directory service. Forinstance, first database 140 may include a corporate directory thatcomprises employees' information, such as the employees' first and lastnames, usernames, email addresses, phone numbers, departmentinformation, etc. In some embodiments, first database 140 may beencrypted to protect the information contained therein. First database140 may include, but are not limited to relational databases,hierarchical databases, distributed databases, in-memory databases, flatfile databases, XML databases, NoSQL databases, graph databases, and/ora combination thereof.

First network 150 may include any type of network. In this regard, firstnetwork 150 may include the Internet, a local area network (LAN), a widearea network (WAN), a wireless telecommunications network, and/or anyother communication network or combination thereof. It will beappreciated that the network connections shown are illustrative and anymeans of establishing a communications link between the computers may beused. The existence of any of various network protocols such as TCP/IP,Ethernet, FTP, HTTP and the like, and of various wireless communicationtechnologies such as GSM, CDMA, WiFi, and LTE, is presumed, and thevarious computing devices described herein may be configured tocommunicate using any of these network protocols or technologies. Thedata transferred to and from various computing devices in system 100 mayinclude secure and sensitive data, such as confidential documents,customer personally identifiable information, and account data.Therefore, it may be desirable to protect transmissions of such datausing secure network protocols and encryption, and/or to protect theintegrity of the data when stored on the various computing devices. Forexample, a file-based integration scheme or a service-based integrationscheme may be utilized for transmitting data between the variouscomputing devices. Data may be transmitted using various networkcommunication protocols. Secure data transmission protocols and/orencryption may be used in file transfers to protect the integrity of thedata, for example, File Transfer Protocol (FTP), Secure File TransferProtocol (SFTP), and/or Pretty Good Privacy (PGP) encryption. In manyembodiments, one or more web services may be implemented within thevarious computing devices. Web services may be accessed by authorizedexternal devices and users to support input, extraction, andmanipulation of data between the various computing devices in the system100. Web services built to support a personalized display system may becross-domain and/or cross-platform, and may be built for enterprise use.Data may be transmitted using the Secure Sockets Layer (SSL) orTransport Layer Security (TLS) protocol to provide secure connectionsbetween the computing devices. Web services may be implemented using theWS-Security standard, providing for secure SOAP messages using XMLencryption. Specialized hardware may be used to provide secure webservices. For example, secure network appliances may include built-infeatures such as hardware-accelerated SSL and HTTPS, WS-Security, and/orfirewalls. Such specialized hardware may be installed and configured insystem 100 in front of one or more computing devices such that anyexternal devices may communicate directly with the specialized hardware.

Any of the devices and systems described herein may be implemented, inwhole or in part, using one or more computing systems described withrespect to FIG. 2 . Turning now to FIG. 2 , a computing device 200 thatmay be used with one or more of the computational systems is described.The computing device 200 may include a processor 203 for controllingoverall operation of the computing device 200 and its associatedcomponents, including RAM 205, ROM 207, input/output device 209,accelerometer 211, global-position system antenna 213, memory 215,and/or communication interface 223. A data bus may interconnectprocessor(s) 203, RAM 205, ROM 207, memory 215, I/O device 209,accelerometer 211, global-position system receiver/antenna 213, memory215, and/or communication interface 223. In some embodiments, computingdevice 200 may represent, be incorporated in, and/or include variousdevices such as a desktop computer, a computer server, a mobile device,such as a laptop computer, a tablet computer, a smart phone, any othertypes of mobile computing devices, and the like, and/or any other typeof data processing device.

Input/output (I/O) device 209 may include a microphone, keypad, touchscreen, and/or stylus through which a user of the computing device 200may provide input, and may also include one or more of a speaker forproviding audio output and a video display device for providing textual,audiovisual, and/or graphical output. In some embodiments, I/O device209 may include an image capture device, such as a camera. Software maybe stored within memory 215 to provide instructions to processor 203allowing computing device 200 to perform various actions. For example,memory 215 may store software used by the computing device 200, such asan operating system 217, application programs 219, and/or an associatedinternal database 221. The various hardware memory units in memory 215may include volatile and nonvolatile, removable and non-removable mediaimplemented in any method or technology for storage of information suchas computer-readable instructions, data structures, program modules, orother data. Memory 215 may include one or more physical persistentmemory devices and/or one or more non-persistent memory devices. Memory215 may include, but is not limited to, random access memory (RAM) 205,read only memory (ROM) 207, electronically erasable programmable readonly memory (EEPROM), flash memory or other memory technology, opticaldisk storage, magnetic cassettes, magnetic tape, magnetic disk storageor other magnetic storage devices, or any other medium that may be usedto store the desired information and that may be accessed by processor203.

Accelerometer 211 may be a sensor configured to measure acceleratingforces of computing device 200. Accelerometer 211 may be anelectromechanical device. Accelerometer may be used to measure thetilting motion and/or orientation computing device 200, movement ofcomputing device 200, and/or vibrations of computing device 200. Theacceleration forces may be transmitted to the processor to process theacceleration forces and determine the state of computing device 200.

GPS receiver/antenna 213 may be configured to receive one or moresignals from one or more global positioning satellites to determine ageographic location of computing device 200. The geographic locationprovided by GPS receiver/antenna 213 may be used for navigation,tracking, and positioning applications. In this regard, the geographicmay also include places and routes frequented by the first user. In thecontext of a locking application, GPS receiver/antenna 213 may be usedto locate the computing device 200 to determine whether a currentlocation is a location that satisfies an unlock condition. In someembodiments, GPS receiver/antenna 213 may be used to determine theorientation of a device (e.g., facing north), as part of determiningwhether an unlock condition is satisfied.

Communication interface 223 may include one or more transceivers,digital signal processors, and/or additional circuitry and software forcommunicating via any network, wired or wireless, using any protocol asdescribed herein.

Processor 203 may include a single central processing unit (CPU), whichmay be a single-core or multi-core processor, or may include multipleCPUs. Processor(s) 203 and associated components may allow the computingdevice 200 to execute a series of computer-readable instructions toperform some or all of the processes described herein. Although notshown in FIG. 2 , various elements within memory 215 or other componentsin computing device 200, may include one or more caches, for example,CPU caches used by the processor 203, page caches used by the operatingsystem 217, disk caches of a hard drive, and/or database caches used tocache content from database 221. For embodiments including a CPU cache,the CPU cache may be used by one or more processors 203 to reduce memorylatency and access time. A processor 203 may retrieve data from or writedata to the CPU cache rather than reading/writing to memory 215, whichmay improve the speed of these operations. In some examples, a databasecache may be created in which certain data from a database 221 is cachedin a separate smaller database in a memory separate from the database,such as in RAM 205 or on a separate computing device. For instance, in amulti-tiered application, a database cache on an application server mayreduce data retrieval and data manipulation time by not needing tocommunicate over a network with a back-end database server. These typesof caches and others may be included in various embodiments, and mayprovide potential advantages in certain implementations of devices,systems, and methods described herein, such as faster response times andless dependence on network conditions when transmitting and receivingdata.

Although various components of computing device 200 are describedseparately, functionality of the various components may be combinedand/or performed by a single component and/or multiple computing devicesin communication without departing from the invention.

Users may wish to indicate (e.g., define) a lock condition under which adevice may not be unlocked, even if the user were coerced, or otherwisecompelled, to provide their username and password. For instance, a usertravelling internationally with a device that contains confidential, orother highly sensitive information, may not want the device to beunlocked until he/she reaches his/her destination. The user mayimplement the machine learning-based locking techniques described hereinto ensure that the device remains locked until the user arrives athis/her destination. In order to effectuate the lock, the user may haveto configure the machine learning-based locking application to recognizeone or more user features. FIG. 3 shows a flow chart of a process fortraining a machine learning model to recognize one or more user featuresaccording to one or more aspects of the disclosure. Some or all of thesteps of process 300 may be performed using one or more computingdevices as described herein.

As discussed above, the user may obtain the machine learning-basedlocking mechanism from an online retail store or a digital distributionservice or from an administrator as part of a mobile device management(MDM) program. In order to make use of the machine learning-basedlocking mechanism, the user may have to configure the lockingapplication to recognize one or more of the user's features. In step310, a user may indicate (e.g., define) a plurality of first featuresfor the locking application to recognize. The plurality of firstfeatures may include user features, such as a biometric identifier(e.g., facial recognition, voiceprint, retina scan, fingerprint, etc.).In some instances, the biometric identifier may be further defined to beunique to a user. For example, the user may make a silly face as part ofthe facial recognition. Alternatively, the facial recognition may befrom a unique perspective, such as a profile or from below. In anotherexample, the user may define the voiceprint to be a funny word or aunique noise. Additionally, or alternatively, the plurality of firstfeatures may include environmental features, such as a background image,such as the user's home, the user's office, etc. In some instances, thebackground image may be associated with a location. In this regard, theplurality of first features may include one or more images associatedwith a location determined by the device's GPS antenna/receiver.

After the user defines a plurality of first features, the user device(e.g., the locking application executing on the user device) may train afirst machine learning model to recognize a first feature of theplurality of features in step 320. In some example embodiments, the userdevice may extract one or more features from an image using a featureextraction technique, such as scale-invariant feature transform (SIFT),speeded-up robust features (SURF), or an equivalent thereof. The one ormore extracted features may then be provided to a machine learning modelsuch that the machine learning model can be trained to recognize the oneor more extracted features. The first machine learning model may asupport vector machine, logistic regression, random forest, or anequivalent thereof. Additionally, or alternatively, the machine learningmodel may be a convolutional neural network, a recurrent neural network,a recursive neural network, a long short-term memory (LSTM), a gatedrecurrent unit (GRU), an unsupervised pre-trained network, a spaceinvariant artificial neural network, or any equivalent thereof. In someembodiments, the first machine learning model may be an existing machinelearning model. In further embodiments, the first machine learning modelmay be a proprietary model. Alternatively, the first machine learningmodel may be a modified existing machine learning model such that thefirst machine learning model becomes proprietary. In some instances, thefirst machine learning model may be trained using different parameters,such as back propagation, transfer learning, stochastic gradientdescent, learning rate decay, dropout, max pooling, batch normalization,long short-term memory, skip-gram, and/or any equivalent deep learningtechnique. According to some embodiments, the first machine learningmodel may generate a first baseline feature vector for the firstfeature. The first baseline feature vector may be used for verificationpurposes (e.g., as the verified feature to which subsequent verificationattempts may be compared). In practice, the user device (e.g., thelocking application executing on the user device) may obtain samples ofthe first feature from the user until the user device is able torecognize the first feature. These samples may be provided as part of anenrollment process. For example, the user device may prompt the user torepeat a passphrase or passcode. The microphone may record the user'svoice until the user device is able to recognize the user's voice aspart of a voiceprint authentication. Alternatively, these samples may beobtained in a more passive way. For instance, the user device (e.g., thelocking application on the user device) may obtain a picture of the userfrom a forward-facing camera each time the user logs in to the device orwhile the user is working at the device.

While the first model is being trained to recognize the first feature,the user device may obtain a plurality of secondary features in step320. The plurality of secondary features may include a plurality of userfeatures and environmental features. The secondary features may includelatent features in the plurality of first features as determined by thefirst machine learning model during the training of the first machinelearning model to identify the first features. In some embodiments, thesecondary features may include ambient sounds. The ambient sounds may bereceived by the microphone while recording the user's voice. The ambientsounds may include a variety of noises, such as, street noise, radiosounds, phones ringing, typing tempo, or any other typical office noise.In some instances, the secondary features may include one or morebackground features. The forward facing camera may obtain one or morefeatures of the user's background when training the facial recognitionfeature. As will be discussed in greater detail below with respect toFIG. 4 , the one or more background features may be associated with aparticular location (e.g., the user's home or office). In this regard,the camera may obtain the user's desk, a wall-mounted photo, a window, atree outside the window, or any other features that may be typicallyfound in a user's home or office. The plurality of secondary featuresmay be transferred to a second model for transfer learning purposes.

In step 340, the user device may train a second model to recognize asecond feature of the plurality of secondary features. In someembodiments, the second model may be the same as the first model. In avariety of embodiments, the second model may be different from the firstmodel. Further, the second model may be trained in a manner similar tothe techniques described above with respect to step 320. The secondfeature may be obtained in the same manner as the first feature. Forexample, the second feature may be obtained by the forward facing camerawhile obtaining images of the user for facial recognitionauthentication. Similarly, the second feature may be obtained by themicrophone while obtaining one or more sounds to authenticate the user.In some embodiments, the second machine learning model may generate asecond baseline feature vector for the second feature, which may be usedfor subsequent verification attempts.

In step 350, the user device (e.g., the locking application executing onthe user device) may notify the user that the first feature is ready tobe used as an unlocking condition. Similarly, the user device may notifythe user that the second feature is ready to be used as an unlockingcondition in step 360. In both instances, the user device (e.g., thelocking application executing on the user device) may provide anindication to the user that the first model and the second model havebeen trained to recognize the first feature and the second feature,respectively. These notifications may be provided at the completion ofan enrollment process. Alternatively, the user device (e.g., the lockingapplication executing on the user device) may be passively obtaining thefirst feature and the second feature from the user. That is, the userdevice may obtain samples from the user throughout the day, or over thecourse of several days, as the device is used. In this context, the userdevice (e.g., the locking application executing on the user device) mayprovide an electronic notification, such as a push notification, a textmessage, an e-mail, or any equivalent thereof to indicate that the firstfeature and the second feature are ready to be used as authenticationparameters.

As discussed above, a user may select one or more features that the userwould like to use for verification (e.g., authentication) purposes thatwould unlock the device. FIG. 4 shows an example of configuring alocking mechanism with one or more authentication features according toone or more aspects of the disclosure.

FIG. 4 illustrates second user device 120 comprising a camera 410, amicrophone 420, and a display 430. As noted above, the camera 410 may beused to obtain one or more authentication features (e.g., facialrecognition, background images and/or features). Similarly, themicrophone 420 may be used to obtain one or more authentication features(e.g., voiceprint, ambient sounds, etc.). The display 430 may be anydisplay capable of presenting a configuration screen. The configurationscreen may allow a user to indicate (e.g., define) one or moreauthentication features that may be used to subsequently unlock thesecond user device 120. As illustrated, the configuration screen mayallow the user to select one or more features for user verification,such as facial recognition, fingerprint authentication, voiceprintauthentication, or a retina scan. A user may select one or more of thesefeatures, after which the second device 120 may obtain one or moresamples associated with the selected feature to train a machine learningmodel to recognize the selected feature. As illustrated, a user hasselected facial recognition. Accordingly, second device 120 may obtainsample images of the user's face using the camera 410. FIG. 4 also showsthat the user may define location as an authentication feature. In thissense, second device 120 may obtain sample images of the user'sbackground and associate the sample images with the user's home. In someembodiments, images of the user's background may be associated with ageographic location determined using location services on the seconddevice 120. The location services may include GPS. Alternatively, thelocation services may include an indoor location service, for example,that determines the user's location indoors using the roundtrip timefrom the user's device to a base station. In some instances, the seconddevice 120 may use a combination of GPS and the indoor location service.

In response to selecting one or more authentication features to train, auser device may activate one or more input devices (e.g., camera ormicrophone) to obtain samples of the selected features to train themachine learning model. FIG. 5 shows an example of training the lockingmechanism to recognize one or more user features according to one ormore aspects of the disclosure.

FIG. 5 continues the example discussed above in FIG. 4 . The user hasselected to train the second user device 120 to recognize the user'sface and the background image of the user's home. The second user device120 may activate the camera 410 to obtain samples of the user and theuser's home. FIG. 5 shows that the second user device 120 may recognizethe user 505. In addition to user 505, the second user device 120 mayalso recognize a desk 510, a picture 515, a window 520, and a tree 525.As discussed above, the second user device 120 may obtain the imagepresented in FIG. 5 as part of an enrollment process. Alternatively, thesecond user device 120 may obtain the image of FIG. 5 passively, forexample, by capturing images of the user when the second user device 120determines that the user 505 is using the second user device 120. Itwill be appreciated that the second user device 120 may not display theimage depicted in FIG. 5 as part of the training process. Instead, thesecond user device 120 may allow the user to perform tasks while thesecond user device 120 may learn to recognize the user's face and thefeatures in the background of the user's home. During the trainingprocess, the second user device 120 may separate the user's face fromthe background image. In this regard, the face learned during thetraining at the user's home may be used to authenticate the user at theoffice and other locations. Similarly, the background image of theuser's home, and the features contained therein (e.g., desk 510, picture515, window 520, and tree 525) may be associated with the user's home.Accordingly, when the user later defines the unlock condition to includethe user's home, the second user device 120 may search for desk 510,picture 515, window 520, and tree 525. As will be discussed in greaterdetail below, once the model is trained to recognize the backgroundimage of the user's home, the second user device 120 may unlock thedevice, for example, based on the second user device 120 detecting desk510, picture 515, window 520, and tree 525 in the user's background.

After the model has been trained to recognize one or more of thefeatures defined by the user, the user may set an unlock condition thatincludes the one or more features capable of being recognized by thelocking application. FIG. 6 shows a flow chart of a process for lockinga device according to one or more aspects of the disclosure. Some or allof the steps of process 600 may be performed using one or more computingdevices as described herein.

In step 610, the first user device may receive a lock command. In someinstances, the lock command may be received by the operating systemexecuting on the first user device. In a variety of embodiments, thelock command may be received by a locking application executing on thefirst device.

In step 620, the first user device may prompt a first user to indicate(e.g., define) an unlock condition. To define the unlock condition, theuser may select one or more features to be verified. When the one ormore features are verified, the locking application may unlock the firstuser device. However, when the one or more features are not verified,the locking application may maintain the lock on the first user device.As noted above, the one or more features may be selected from facialrecognition, fingerprint authentication, voiceprint authentication,retina scan, a location (e.g., home or office), a background image,ambient sounds, or any combination thereof.

In step 630, the first user device may be locked. As discussed above,the locking mechanism may be a default lock provided by the manufacturerof the device or the developer of the device's operating system.Alternatively, the locking mechanism may be an application downloadedand installed on the first user device by the user. In some instances,the locking mechanism may be installed on the first user device by anadministrator of the user's work network as part of an MDM solution.

In step 640, the first user device (e.g., the locking mechanismexecuting on the first device) may encrypt a storage medium of the firstdevice. The storage medium may be the main memory of the first userdevice. In this regard, the storage medium may be any suitable memory,such as a hard disk drive or a solid state drive. The locking mechanismmay derive an encryption key, to encrypt the storage medium, based onthe one or more features selected as the unlock condition.Alternatively, the encryption key may be a pseudorandom string ofcharacters generated using a pseudorandom number generator. The lockingmechanism may use the derived encryption key and an encryption algorithmto encrypt the storage medium.

Turning to FIG. 7 , an example of defining an unlock condition accordingto one or more aspects of the disclosure is shown. FIG. 7 shows thesecond user device 120, which includes camera 410, microphone 420, anddisplay 430. The display 430 may show a screen that allows a user toindicate (e.g., define) an unlock condition. The unlock condition may beselected from a variety of factors. For example, the unlock conditionmay verify the user using facial recognition, fingerprint recognition, avoiceprint, a retina scan, or any combination thereof. Additionally, oralternatively, the unlock condition may verify the location of the firstdevice. The location may be verified using location services (e.g.,GPS), a background image, background noise (e.g. ambient sounds), or anycombination thereof. In another example, the unlock condition may set atimeframe on when the second device 120 may be unlocked. For instance,certain dates and/or times may be selected during which the seconddevice 120 may be unlocked. It will be appreciated that the examplesprovided above are merely illustrative, and any equivalents may be usedin place of the examples described above.

Furthermore, it should be recognized that any combination or permutationof features may be combined to define the unlock condition. In someembodiments, some features do not have a baseline feature vectorestablished may be ineligible for the unlock condition. These featuresmay be grayed out, or otherwise unavailable for the user's selection. Infurther embodiments, the unlock condition may be set by a systemadministrator and a notification may be provided as to the featuresrequired to satisfy the unlock condition.

In the example shown in FIG. 7 , the user has selected facialrecognition, an office location, a background image, and a timerestriction as an unlock condition. Accordingly, to satisfy the unlockcondition and unlock the second device 120, the user may have to providean image that includes the user's face and office background, thelocation services of second device 120 may have to detect that thedevice is located at the user's office, and the attempt to unlock mayhave to be between the times defined by the user (e.g., Monday throughFriday, between 8:00 am and 6:00 pm). By defining locking conditions inthis way, a thief may not be able to access a stolen locked devicebecause the thief will not be able to satisfy the unlock condition.Furthermore, coercion may not unlock the device. In this regard, thelocking mechanism may detect that the user is in poor health or underduress and maintain the lock condition to protect the sensitive orconfidential information contained on the second device 120.

After defining a locking condition, the user may gain access to theirdevice by satisfying the defined unlock condition. FIG. 8 shows a flowchart of a process for unlocking the device according to one or moreaspects of the disclosure. Some or all of the steps of process 800 maybe performed using one or more computing devices as described herein.

In step 805, the first device (e.g., the locking application) mayreceive a request to unlock the first device. In step 810, the firstdevice may activate one or more input devices (e.g., camera, microphone,location services, fingerprint scanner, retina scanner, etc.).Activation of the one or more input devices may be based on, or inresponse to, the request to unlock the first device. In some instances,the first device may be passively monitoring the device's environment.In this regard, the one or more input devices may be constantlymonitoring. Alternatively, the one or more input devices may beintermittently monitoring to determine whether the unlock conditionshave been satisfied.

In step 815, the first device (e.g., the locking application executingon the first device) may obtain a first authentication parameter. Thefirst authentication parameter may be obtained using the one or moreinput devices. In step 820, the first device (e.g., the lockingapplication executing on the first device) may obtain a secondauthentication parameter. Much like the first authentication parameter,the second authentication parameter may be obtained using the one ormore input devices. In step 825, the first device may determine whetherthe first authentication parameter matches a first feature defined aspart of the unlock condition. Determining whether the firstauthentication parameter matches the first feature may comprisegenerating a first feature vector from the first authenticationparameter. The first feature vector may be generated using any of themachine learning models or neural networks described above. The firstfeature vector may then be compared to a first baseline feature vectorof the first feature. When the first feature vector does not match thefirst baseline feature vector, the lock on the first device may bemaintained in step 830. However, when the first authentication parametermatches the first feature, process 800 may proceed to step 835 to verifyone or more second authentication parameters.

In step 835, the first device may determine whether the secondauthentication parameter matches a second feature defined as part of theunlock condition. Much like authenticating the first authenticationparameter, the first device may generate a second feature vector fromthe second authentication parameter. The second feature vector may thenbe compared to a second baseline feature vector of the second feature.When the second feature vector does not match the second baselinefeature vector, the lock on the first device may be maintained in step830.

When the second authentication parameter matches the second feature, thefirst device may be unlocked in step 840. Unlocking the device maycomprise transitioning from a locked screen to an unlocked screen or agraphical user interface (e.g., desktop). In some embodiments, the firstdevice may prompt the user for a username and password in step 845. Thismay be a precautionary measure that provides an additional layer ofsecurity. In response to receiving the user's username and password, thefirst device may verify the received username and password in step 850.This may include comparing the received username and password to astored username and password. If the received username and password arenot verified, process 800 may return to step 830 and the first devicemay maintain the lock on the first device. When the received usernameand password are verified, the first device may transition from a lockedscreen to an unlocked screen or a graphical user interface (e.g.,desktop). In step 855, the first device may decrypt a storage medium. Asnoted above, the first device (e.g., the locking application executingon the first device) may derive the encryption key, used to decrypt thestorage medium, using the one or more features obtained as part of theunlocking condition. For example, the first authentication parameter andthe second authentication parameter may be used to derive the encryptionkey to decrypt the storage medium.

It will be appreciated that the techniques described above for unlockingthe first device may occur in a different sequence. Further, certainsteps may be skipped or omitted. For example, the password verificationdescribed in steps 845 and 850 may be skipped or omitted entirely.Furthermore, it will be appreciated that a user may define one featureas an unlock condition. In these instances, step 835 may be skipped oromitted. Similarly, the user may define more than two features forauthentication purposes. Accordingly, steps 825 and 835 may be repeateduntil each of the features defined as an unlock condition have beenauthenticated.

Unlocking conditions may be recognized as reproducing the conditions atlocations that were deemed secure at the time the locking applicationwas trained to recognize one or more user features. However, users maytravel with their devices. During their travels, the user may be askedto unlock their device, for example, when travelling through airportsecurity. FIGS. 9A and 9B show an example of a failed unlock attemptaccording to one or more aspects of the disclosure.

FIG. 9A illustrates second device 120. A user may be travelling throughairport security, during which time, the user may be asked to unlocktheir device. When the user has locked their device according to thetechniques described herein, the user may be unable to unlock theirdevice. For instance, the user may have set a plurality of featuresdiscussed above as part of the unlock condition. Accordingly, inresponse to a request to unlock the device, the user may attempt tounlock the second device 120. The second device 120 (e.g. lockingapplication) may recognize user 905, for example, using camera 410.However, the second device 120 may not recognize the background imagedetected by camera 410. Similarly, the location of the second device 120may not be associated with the user's home or office. Accordingly, thesecond user device 120 may not recognize the location provided by thelocation services located on the second user device 120. Further, thesecond user device 120 may recognize a voiceprint provided by user 905;however, the second user device 120 may not recognize one or moreambient sounds. Regardless of whether the second user device 120 failsto recognize the background image, the location of the second device120, and/or the ambient noises, the second user device 120 may maintainthe lock condition on the second user device 120 since all of the unlockconditions have not been satisfied. Accordingly, a verification failedmessage 910 may be displayed on the second user device 120, as shown inFIG. 9B. The locking application may prevent unauthorized access to thedevice if one or more unlock conditions are not satisfied, even if theuser is verified. The user may surrender their device to airportsecurity as a result of being unable to unlock their device. However,the user (and their company) may be assured that the informationcontained therein has not been compromised or breached.

One or more aspects discussed herein may be embodied in computer-usableor readable data and/or computer-executable instructions, such as in oneor more program modules, executed by one or more computers or otherdevices as described herein. Generally, program modules includeroutines, programs, objects, components, data structures, and the like.that perform particular tasks or implement particular abstract datatypes when executed by a processor in a computer or other device. Themodules may be written in a source code programming language that issubsequently compiled for execution, or may be written in a scriptinglanguage such as (but not limited to) HTML or XML. The computerexecutable instructions may be stored on a computer readable medium suchas a hard disk, optical disk, removable storage media, solid-statememory, RAM, and the like. As will be appreciated by one of skill in theart, the functionality of the program modules may be combined ordistributed as desired in various embodiments. In addition, thefunctionality may be embodied in whole or in part in firmware orhardware equivalents such as integrated circuits, field programmablegate arrays (FPGA), and the like. Particular data structures may be usedto more effectively implement one or more aspects discussed herein, andsuch data structures are contemplated within the scope of computerexecutable instructions and computer-usable data described herein.Various aspects discussed herein may be embodied as a method, acomputing device, a system, and/or a computer program product.

Although the present invention has been described in certain specificaspects, many additional modifications and variations would be apparentto those skilled in the art. In particular, any of the various processesdescribed above may be performed in alternative sequences and/or inparallel (on different computing devices) in order to achieve similarresults in a manner that is more appropriate to the requirements of aspecific application. It is therefore to be understood that the presentinvention may be practiced otherwise than specifically described withoutdeparting from the scope and spirit of the present invention. Thus,embodiments of the present invention should be considered in allrespects as illustrative and not restrictive. Accordingly, the scope ofthe invention should be determined not by the embodiments illustrated,but by the appended claims and their equivalents.

What is claimed is:
 1. A computing device comprising: one or moreprocessors; and memory storing instructions that, when executed by theone or more processors, cause the computing device to: receive a requestto unlock a portion of the computing device's capabilities; receive, viaone or more inputs of the computing device, a first authenticationparameter and a second authentication parameter, wherein the secondauthentication parameter comprises a background element; determine,using a first machine learning model trained to identify a firstbaseline parameter associated with a lock condition, that the firstauthentication parameter matches the first baseline parameter;determine, using the first machine learning model, a physical state of auser requesting unlocking of the portion of the computing device'scapabilities; determine, using a second machine learning model trainedto identify a second baseline parameter associated with the lockcondition, that the second authentication parameter matches the secondbaseline parameter; determine, based on the physical state of the user,based on the first authentication parameter matching the first baselineparameter, and based on the second authentication parameter matching thesecond baseline parameter, that an unlock condition has been satisfied;and unlock, based on a determination that the unlock condition has beensatisfied, the portion of the computing device's capabilities.
 2. Thecomputing device of claim 1, wherein the instructions, when executed bythe one or more processors, cause the computing device to: decrypt astorage medium associated with the computing device.
 3. The computingdevice of claim 1, wherein the first authentication parameter comprisesa biometric identifier.
 4. The computing device of claim 3, wherein thebackground element comprises at least one of: a background associatedwith a location; a background image; an ambient sound; or an orientationof the computing device.
 5. The computing device of claim 1, wherein theinstructions, when executed by the one or more processors, cause thecomputing device to: receive a lock command, wherein the lock commandcomprises a definition of the unlock condition.
 6. The computing deviceof claim 1, wherein the instructions, when executed by the one or moreprocessors, cause the computing device to: determine that a firstgeographic location of the computing device corresponds to a secondgeographic location defined in the unlock condition.
 7. The computingdevice of claim 1, wherein the instructions, when executed by the one ormore processors, cause the computing device to determine that the unlockcondition has been satisfied by determining that a current timecorresponds to a time range defined in the unlock condition.
 8. Thecomputing device of claim 1, wherein the instructions, when executed bythe one or more processors, cause the computing device to determine thatthe physical state of the user is at least one or more of: not beingcoerced; not in poor health; or not under duress.
 9. A non-transitorycomputer-readable medium storing instructions that, when executed,configure a computing device to: receive a request to unlock a portionof the computing device's capabilities; receive, via one or more inputsof the computing device, a first authentication parameter and a secondauthentication parameter, wherein the second authentication parametercomprises a background element; determine, using a first machinelearning model trained to identify a first baseline parameter associatedwith a lock condition, that the first authentication parameter matchesthe first baseline parameter; determine, using the first machinelearning model, a physical state of a user requesting unlocking of theportion of the computing device's capabilities; determine, using asecond machine learning model trained to identify a second baselineparameter associated with the lock condition, that the secondauthentication parameter matches the second baseline parameter;determine, based on the physical state of the user, based on the firstauthentication parameter matching the first baseline parameter, andbased on the second authentication parameter matching the secondbaseline parameter, that an unlock condition has been satisfied; andunlock, based on a determination that the unlock condition has beensatisfied, the portion of the computing device's capabilities.
 10. Thenon-transitory computer-readable medium of claim 9, wherein theinstructions, when executed, configure the computing device to: decrypta storage medium associated with the computing device.
 11. Thenon-transitory computer-readable medium of claim 9, wherein the firstauthentication parameter comprises a biometric identifier.
 12. Thenon-transitory computer-readable medium of claim 11, wherein thebackground element comprises at least one of: a background associatedwith a location; a background image; an ambient sound; or an orientationof the computing device.
 13. The non-transitory computer-readable mediumof claim 9, wherein the instructions, when executed, configure thecomputing device to: receive a lock command, wherein the lock commandcomprises a definition of the unlock condition.
 14. The non-transitorycomputer-readable medium of claim 9, wherein the instructions, whenexecuted, configure the computing device to: determine that a firstgeographic location of the computing device corresponds to a secondgeographic location defined in the unlock condition.
 15. Thenon-transitory computer-readable medium of claim 9, wherein theinstructions, when executed, configure the computing device to determinethat the unlock condition has been satisfied by determining that acurrent time corresponds to a time range defined in the unlockcondition.
 16. The computing device of claim 9, wherein theinstructions, when executed by the one or more processors, cause thecomputing device to determine that the physical state of the user is atleast one or more of: not being coerced; not in poor health; or notunder duress.
 17. A computing device comprising: one or more processors;and memory storing instructions that, when executed by the one or moreprocessors, cause the computing device to: define a plurality offeatures for unlocking a portion of the computing device's capabilities;train a machine learning model to recognize a first feature and a secondfeature; define, based on training the machine learning model torecognize the first feature and the second feature, an unlock condition,wherein the unlock condition comprises authenticating the first featureand the second feature; and lock, based on defining the unlockcondition, the portion of the computing device's capabilities.
 18. Thecomputing device of claim 17, wherein the instructions, when executed bythe one or more processors, cause the computing device to encrypt astorage medium associated with the computing device.
 19. The computingdevice of claim 17, wherein the first feature comprises a biometricidentifier of a user.
 20. The computing device of claim 19, wherein thesecond feature comprises at least one of: a background associated with alocation; a background image; an ambient sound; or an orientation of thecomputing device.
 21. The computing device of claim 17, wherein thedefining the unlock condition comprises at least one of: defining ageographic location where the computing device may be unlocked; ordefining a time range for when the computing device may be unlocked. 22.A non-transitory computer-readable medium storing instructions that,when executed, configure a computing device to: define a plurality offeatures for unlocking a portion of the computing device's capabilities;train a machine learning model to recognize a first feature and a secondfeature; define, based on training the machine learning model torecognize the first feature and the second feature, an unlock condition,wherein the unlock condition comprises authenticating the first featureand the second feature; and lock, based on defining the unlockcondition, the portion of the computing device's capabilities.
 23. Thenon-transitory computer-readable medium of claim 22, wherein theinstructions, when executed, configure the computing device to encrypt astorage medium associated with the computing device.
 24. Thenon-transitory computer-readable medium of claim 22, wherein the firstfeature comprises a biometric identifier of a user.
 25. Thenon-transitory computer-readable medium of claim 24, wherein the secondfeature comprises at least one of: a background associated with alocation; a background image; an ambient sound; or an orientation of thecomputing device.
 26. The non-transitory computer-readable medium ofclaim 22, wherein the defining the unlock condition comprises at leastone of: defining a geographic location where the computing device may beunlocked; or defining a time range for when the computing device may beunlocked.